The vulnerability in the Flipper Code WP Maps plugin allows sensitive information to be inserted into data sent by the plugin, leading to exposure of confidential data stored within the plugin. This is a classic case of CWE‑201, where unauthorized access to sensitive data is possible. The impact is direct disclosure of user or site data that may be protected under privacy regulations.

Flipper Code’s WP Maps plugin, versions 4.9.6 and earlier, are affected. Any WordPress site deploying this plugin before the release of version 4.9.7 runs the risk of leaking embedded sensitive data via the plugin’s output or API calls.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% shows that the likelihood of exploitation at the time of this analysis is very low. The vulnerability is not listed in the CISA KEV catalog, suggesting that it is not currently being actively abused. Nonetheless, the attack would most likely occur through the plugin’s exposed API endpoints or by manipulating URLs that trigger data rendering, so sites should treat this as a moderate risk until a patch is applied.